Merge staging-next into staging

.github/CODEOWNERS

@@ -41,7 +41,8 @@
 /pkgs/build-support/cc-wrapper                   @Ericson2314
 /pkgs/build-support/bintools-wrapper             @Ericson2314
 /pkgs/build-support/setup-hooks                  @Ericson2314
-/pkgs/build-support/setup-hooks/auto-patchelf.sh @aszlig
+/pkgs/build-support/setup-hooks/auto-patchelf.sh @layus
+/pkgs/build-support/setup-hooks/auto-patchelf.py @layus
 
 # Nixpkgs build-support
 /pkgs/build-support/writers @lassulus @Profpatsch

nixos/doc/manual/from_md/release-notes/rl-2205.section.xml

@@ -1043,6 +1043,14 @@
           <literal>admin</literal> and <literal>password</literal>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The <literal>taskserver</literal> module no longer implicitly
+          opens ports in the firewall configuration. This is now
+          controlled through the option
+          <literal>services.taskserver.openFirewall</literal>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           The <literal>autorestic</literal> package has been upgraded
@@ -2150,6 +2158,12 @@
           <link xlink:href="https://github.com/uber/pam-ussh">pam-ussh</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The <literal>vscode-extensions.ionide.ionide-fsharp</literal>
+          package has been updated to 6.0.0 and now requires .NET 6.0.
+        </para>
+      </listitem>
       <listitem>
         <para>
           The <literal>zrepl</literal> package has been updated from

nixos/doc/manual/release-notes/rl-2205.section.md

@@ -443,6 +443,10 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `services.miniflux.adminCredentialFiles` is now required, instead of defaulting to `admin` and `password`.
 
+- The `taskserver` module no longer implicitly opens ports in the firewall
+  configuration. This is now controlled through the option
+  `services.taskserver.openFirewall`.
+
 - The `autorestic` package has been upgraded from 1.3.0 to 1.5.0 which introduces breaking changes in config file, check [their migration guide](https://autorestic.vercel.app/migration/1.4_1.5) for more details.
 
 - For `pkgs.python3.pkgs.ipython`, its direct dependency `pkgs.python3.pkgs.matplotlib-inline`
@@ -774,6 +778,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `security.pam.ussh` has been added, which allows authorizing PAM sessions based on SSH _certificates_ held within an SSH agent, using [pam-ussh](https://github.com/uber/pam-ussh).
 
+- The `vscode-extensions.ionide.ionide-fsharp` package has been updated to 6.0.0 and now requires .NET 6.0.
+
 - The `zrepl` package has been updated from 0.4.0 to 0.5:
 
   - The RPC protocol version was bumped; all zrepl daemons in a setup must be updated and restarted before replication can resume.

nixos/modules/services/misc/taskserver/default.nix

@@ -106,7 +106,7 @@ let
 
   certtool = "${pkgs.gnutls.bin}/bin/certtool";
 
-  nixos-taskserver = with pkgs.python2.pkgs; buildPythonApplication {
+  nixos-taskserver = with pkgs.python3.pkgs; buildPythonApplication {
     name = "nixos-taskserver";
 
     src = pkgs.runCommand "nixos-taskserver-src" { preferLocalBuild = true; } ''
@@ -277,10 +277,6 @@ in {
         example = "::";
         description = ''
           The address (IPv4, IPv6 or DNS) to listen on.
-
-          If the value is something else than <literal>localhost</literal> the
-          port defined by <option>listenPort</option> is automatically added to
-          <option>networking.firewall.allowedTCPPorts</option>.
         '';
       };
 
@@ -292,6 +288,14 @@ in {
         '';
       };
 
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to open the firewall for the specified Taskserver port.
+        '';
+      };
+
       fqdn = mkOption {
         type = types.str;
         default = "localhost";
@@ -560,7 +564,7 @@ in {
         '';
       };
     })
-    (mkIf (cfg.enable && cfg.listenHost != "localhost") {
+    (mkIf (cfg.enable && cfg.openFirewall) {
       networking.firewall.allowedTCPPorts = [ cfg.listenPort ];
     })
   ];

nixos/modules/services/misc/taskserver/helper-tool.py

@@ -90,7 +90,7 @@ def certtool_cmd(*args, **kwargs):
     """
     return subprocess.check_output(
         [CERTTOOL_COMMAND] + list(args),
-        preexec_fn=lambda: os.umask(0077),
+        preexec_fn=lambda: os.umask(0o077),
         stderr=subprocess.STDOUT,
         **kwargs
     )
@@ -164,7 +164,7 @@ def generate_key(org, user):
     pubcert = os.path.join(basedir, "public.cert")
 
     try:
-        os.makedirs(basedir, mode=0700)
+        os.makedirs(basedir, mode=0o700)
 
         certtool_cmd("-p", "--bits", CERT_BITS, "--outfile", privkey)
 
@@ -301,7 +301,7 @@ class Organisation(object):
             return None
         if name not in self.users.keys():
             output = taskd_cmd("add", "user", self.name, name,
-                               capture_stdout=True)
+                               capture_stdout=True, encoding='utf-8')
             key = RE_USERKEY.search(output)
             if key is None:
                 msg = "Unable to find key while creating user {}."
@@ -412,9 +412,9 @@ class Manager(object):
         if org is not None:
             if self.ignore_imperative and is_imperative(name):
                 return
-            for user in org.users.keys():
+            for user in list(org.users.keys()):
                 org.del_user(user)
-            for group in org.groups.keys():
+            for group in list(org.groups.keys()):
                 org.del_group(group)
             taskd_cmd("remove", "org", name)
             del self._lazy_orgs[name]

nixos/tests/taskserver.nix

@@ -63,6 +63,7 @@ in {
     server = {
       services.taskserver.enable = true;
       services.taskserver.listenHost = "::";
+      services.taskserver.openFirewall = true;
       services.taskserver.fqdn = "server";
       services.taskserver.organisations = {
         testOrganisation.users = [ "alice" "foo" ];

pkgs/applications/audio/osdlyrics/default.nix

@@ -0,0 +1,87 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+
+, autoreconfHook
+, pkg-config
+, intltool
+
+, glib
+, gtk2
+, dbus-glib
+, libappindicator-gtk2
+, libnotify
+, python3
+, runtimeShell
+}:
+
+stdenv.mkDerivation rec {
+  pname = "osdlyrics";
+  version = "0.5.10";
+
+  src = fetchFromGitHub {
+    owner = "osdlyrics";
+    repo = "osdlyrics";
+    rev = version;
+    sha256 = "sha256-x9gIT1JkfPIc4RmmQJLv9rOG2WqAftoTK5uiRlS65zU=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    intltool
+  ];
+
+  buildInputs = [
+    glib
+    gtk2
+    dbus-glib
+    libappindicator-gtk2
+    libnotify
+    python3.pkgs.wrapPython
+    (python3.withPackages (pp: with pp; [
+      chardet
+      dbus-python
+      future
+      pycurl
+      pygobject3
+    ]))
+  ];
+
+  postFixup = ''
+    extractExecLine() {
+      serviceFile=$1
+      program=$2
+
+      execLine=$(grep --only-matching --perl-regexp 'Exec=\K(.+)' "$serviceFile")
+      echo "#!${runtimeShell}" > "$program"
+      echo "exec $execLine" >> "$program"
+      chmod +x "$program"
+
+      substituteInPlace "$serviceFile" \
+        --replace "Exec=$execLine" "Exec=$program"
+    }
+
+    # Extract the exec line into a separate program so that it can be wrapped.
+    mkdir -p "$out/libexec/osdlyrics/"
+    for svcFile in "$out/share/dbus-1/services"/*; do
+      svc=$(basename "$svcFile" ".service")
+      if grep "python" "$svcFile"; then
+        extractExecLine "$svcFile" "$out/libexec/osdlyrics/$svc"
+      fi
+    done
+
+    for p in "$out/bin/osdlyrics-create-lyricsource" "$out/bin/osdlyrics-daemon" "$out/libexec/osdlyrics"/*; do
+      wrapProgram "$p" \
+        --prefix PYTHONPATH : "$out/${python3.sitePackages}"
+    done
+  '';
+
+  meta = with lib; {
+    description = "Standalone lyrics fetcher/displayer";
+    homepage = "https://github.com/osdlyrics/osdlyrics";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ jtojnar ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/editors/jupyter-kernels/octave/kernel.nix

@@ -4,20 +4,18 @@ with python3Packages;
 
 buildPythonPackage rec {
   pname = "octave-kernel";
-  version = "0.32.0";
+  version = "0.34.2";
 
   src = fetchPypi {
     pname = "octave_kernel";
     inherit version;
-    sha256 = "0dfbxfcf3bz4jswnpkibnjwlkgy0y4j563nrhaqxv3nfa65bksif";
+    sha256 = "sha256-5ki2lekfK7frPsmPBIzYQOfANCUY9x+F2ZRAQSdPTxo=";
   };
 
   propagatedBuildInputs = [ metakernel ipykernel ];
 
-  # Tests require jupyter_kernel_test to run, but it hasn't seen a
-  # release since 2017 and seems slightly abandoned.
-  # Doing fetchPypi on it doesn't work, even though it exists here:
-  # https://pypi.org/project/jupyter_kernel_test/.
+  # Tests fail because the kernel appears to be halting or failing to launch
+  # There appears to be a similar problem with metakernel's tests
   doCheck = false;
 
   meta = with lib; {

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1123,8 +1123,8 @@ let
         mktplcRef = {
           name = "Ionide-fsharp";
           publisher = "Ionide";
-          version = "5.10.1";
-          sha256 = "sha256-LkWWgyh4khPyUgekVeO8ZzPK+1gTrS8d9Yz6/kHomr8=";
+          version = "6.0.1";
+          sha256 = "sha256-1W1qKnjmyK80np+J6S/nku3QJGypxYnuE0BPw8Onzas=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/Ionide.Ionide-fsharp/changelog";

pkgs/applications/graphics/inkscape/default.nix

@@ -48,6 +48,7 @@ let
       lxml
       pillow
       scour
+      pyserial
     ]);
 in
 stdenv.mkDerivation rec {

pkgs/applications/misc/bottles/default.nix

@@ -21,20 +21,22 @@ in
 python3Packages.buildPythonApplication rec {
   pname = "bottles";
   version = "2022.4.14-trento-1";
-  sha256 = "16cb01fhxa64f8fadwpr0mawfmchig6xlbx20mz4q9yh5fnagywj";
-  # Note: Update via pkgs/applications/misc/bottles/update.py
-  # mostly copypasted from pkgs/applications/networking/instant-messengers/telegram/tdesktop/update.py
 
   src = fetchFromGitHub {
     owner = "bottlesdevs";
     repo = pname;
     rev = version;
-    inherit sha256;
+    sha256 = "16cb01fhxa64f8fadwpr0mawfmchig6xlbx20mz4q9yh5fnagywj";
   };
 
   postPatch = ''
     chmod +x build-aux/meson/postinstall.py
     patchShebangs build-aux/meson/postinstall.py
+
+    substituteInPlace src/backend/wine/winecommand.py \
+      --replace \
+        'self.__get_runner()' \
+        '(lambda r: (f"${steam-run}/bin/steam-run {r}", r)[r == "wine" or r == "wine64"])(self.__get_runner())'
   '';
 
   nativeBuildInputs = [
@@ -89,22 +91,10 @@ python3Packages.buildPythonApplication rec {
   strictDeps = false; # broken with gobject-introspection setup hook, see https://github.com/NixOS/nixpkgs/issues/56943
   dontWrapGApps = true; # prevent double wrapping
 
-  preConfigure = ''
-    patchShebangs build-aux/meson/postinstall.py
-    substituteInPlace src/backend/wine/winecommand.py \
-      --replace \
-        'self.__get_runner()' \
-        '(lambda r: (f"${steam-run}/bin/steam-run {r}", r)[r == "wine" or r == "wine64"])(self.__get_runner())'
-  '';
-
   preFixup = ''
     makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
   '';
 
-  passthru = {
-    updateScript = ./update.py;
-  };
-
   meta = with lib; {
     description = "An easy-to-use wineprefix manager";
     homepage = "https://usebottles.com/";

pkgs/applications/misc/bottles/update.py

@@ -1,65 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -i python3 -p python3 nix nix-prefetch-git
-
-import fileinput
-import json
-import os
-import re
-import subprocess
-
-from datetime import datetime
-from urllib.request import urlopen, Request
-
-
-DIR = os.path.dirname(os.path.abspath(__file__))
-HEADERS = {'Accept': 'application/vnd.github.v3+json'}
-
-
-def github_api_request(endpoint):
-    base_url = 'https://api.github.com/'
-    request = Request(base_url + endpoint, headers=HEADERS)
-    with urlopen(request) as http_response:
-        return json.loads(http_response.read().decode('utf-8'))
-
-
-def get_commit_date(repo, sha):
-    url = f'https://api.github.com/repos/{repo}/commits/{sha}'
-    request = Request(url, headers=HEADERS)
-    with urlopen(request) as http_response:
-        commit = json.loads(http_response.read().decode())
-        date = commit['commit']['committer']['date'].rstrip('Z')
-        date = datetime.fromisoformat(date).date().isoformat()
-        return 'unstable-' + date
-
-
-def nix_prefetch_git(url, rev):
-    """Prefetches the requested Git revision (incl. submodules) of the given repository URL."""
-    print(f'nix-prefetch-git {url} {rev}')
-    out = subprocess.check_output(['nix-prefetch-git', '--quiet', '--url', url, '--rev', rev, '--fetch-submodules'])
-    return json.loads(out)['sha256']
-
-
-def nix_prefetch_url(url, unpack=False):
-    """Prefetches the content of the given URL."""
-    print(f'nix-prefetch-url {url}')
-    options = ['--type', 'sha256']
-    if unpack:
-        options += ['--unpack']
-    out = subprocess.check_output(['nix-prefetch-url'] + options + [url])
-    return out.decode('utf-8').rstrip()
-
-
-def update_file(relpath, version, sha256):
-    file_path = os.path.join(DIR, relpath)
-    with fileinput.FileInput(file_path, inplace=True) as f:
-        for line in f:
-            result = line
-            result = re.sub(r'^  version = ".+";', f'  version = "{version}";', result)
-            result = re.sub(r'^  sha256 = ".+";', f'  sha256 = "{sha256}";', result)
-            print(result, end='')
-
-
-if __name__ == "__main__":
-    bottles_version = github_api_request('repos/bottlesdevs/Bottles/releases/latest')['tag_name']
-    bottles_hash = nix_prefetch_git('https://github.com/bottlesdevs/Bottles.git', bottles_version)
-    update_file('default.nix', bottles_version, bottles_hash)

pkgs/applications/misc/debian-goodies/default.nix

@@ -0,0 +1,70 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, curl
+, dialog
+, installShellFiles
+, perl
+, python3
+}:
+
+stdenv.mkDerivation rec {
+  pname = "debian-goodies";
+  version = "0.87";
+
+  src = fetchFromGitLab {
+    domain = "salsa.debian.org";
+    owner = "debian";
+    repo = "debian-goodies";
+    rev = "debian/${version}";
+    sha256 = "sha256-7O2AY7tWYiOIy4ImFBxWu6S+ljc3VmqS/j4KyEzVVIA=";
+  };
+
+  postPatch = ''
+    substituteInPlace debmany/debmany \
+      --replace "/usr/bin/dialog" "${dialog}/bin/dialog" \
+      --replace "/usr/bin/whiptail" "${python3.pkgs.snack}/bin/whiptail"
+
+    substituteInPlace dman \
+      --replace "curl" "${curl}/bin/curl"
+  '';
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  buildInputs = [
+    perl
+    python3
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    # see https://salsa.debian.org/debian/debian-goodies/-/blob/master/debian/install
+    for bin in checkrestart dgrep dglob debget dpigs debman dman popbugs which-pkg-broke which-pkg-broke-build dhomepage debmany/debmany check-enhancements find-dbgsym-packages; do
+      install -Dm755 $bin -t $out/bin
+    done
+
+    install -Dm644 find-dbgsym-packages-templates/* -t $out/share/debian-goodies/find-dbgsym-packages-templates/
+
+    installShellCompletion --bash \
+      debmany/bash_completion/debmany \
+      debian/bash-completion
+
+    installManPage \
+      *.1 \
+      debmany/man/*.1 \
+      *.8
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Small toolbox-style utilities for Debian systems";
+    homepage = "https://salsa.debian.org/debian/debian-goodies";
+    license = licenses.gpl2Plus;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}

pkgs/applications/networking/browsers/chromium/common.nix

@@ -61,6 +61,13 @@ let
     url = "https://chromium.googlesource.com/chromium/tools/build/+/e77882e0dde52c2ccf33c5570929b75b4a2a2522/recipes/recipe_modules/chromium/resources/clang-format?format=TEXT";
     sha256 = "0ic3hn65dimgfhakli1cyf9j3cxcqsf1qib706ihfhmlzxf7256l";
   };
+  # https://webrtc-review.googlesource.com/c/src/+/255601
+  webrtcWaylandScreenshareCoredumpFix = fetchurl {
+    # PipeWire capturer: check existence of cursor metadata
+    name = "webrtc-wayland-screenshare-coredump-fix.patch";
+    url = "https://webrtc-review.googlesource.com/changes/src~255601/revisions/2/patch?download";
+    hash = "sha256-PHGwEoYhMa+ZL2ner10FwdGUWUxsVr+HWuZOAEugYDY=";
+  };
 
   # The additional attributes for creating derivations based on the chromium
   # source tree.
@@ -162,7 +169,9 @@ let
       ./patches/widevine-79.patch
     ];
 
-    postPatch = ''
+    postPatch = optionalString (versionRange "100" "101") ''
+      base64 --decode ${webrtcWaylandScreenshareCoredumpFix} | patch -p1 -d third_party/webrtc
+    '' + ''
       # remove unused third-party
       for lib in ${toString gnSystemLibraries}; do
         if [ -d "third_party/$lib" ]; then

pkgs/build-support/fetchgit/default.nix

@@ -27,6 +27,7 @@ in
 , # Impure env vars (https://nixos.org/nix/manual/#sec-advanced-attributes)
   # needed for netrcPhase
   netrcImpureEnvVars ? []
+, meta ? {}
 }:
 
 /* NOTE:
@@ -90,5 +91,5 @@ stdenvNoCC.mkDerivation {
     "GIT_PROXY_COMMAND" "NIX_GIT_SSL_CAINFO" "SOCKS_SERVER"
   ];
 
-  inherit preferLocalBuild;
+  inherit preferLocalBuild meta;
 }

pkgs/build-support/fetchurl/default.nix

@@ -160,5 +160,5 @@ stdenvNoCC.mkDerivation {
   '';
 
   inherit meta;
-  inherit passthru;
+  passthru = { inherit url; } // passthru;
 }

pkgs/development/libraries/SDL_audiolib/default.nix

@@ -0,0 +1,53 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, SDL2
+, pkg-config
+}:
+
+stdenv.mkDerivation rec {
+  pname = "SDL_audiolib";
+  version = "unstable-2022-04-17";
+
+  src = fetchFromGitHub {
+    owner = "realnc";
+    repo = "SDL_audiolib";
+    rev = "908214606387ef8e49aeacf89ce848fb36f694fc";
+    sha256 = "sha256-11KkwIhG1rX7yDFSj92NJRO9L2e7XZGq2gOJ54+sN/A=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    SDL2
+  ];
+
+  cmakeFlags = [
+    "-DUSE_RESAMP_SRC=OFF"
+    "-DUSE_RESAMP_SOXR=OFF"
+    "-DUSE_DEC_DRFLAC=OFF"
+    "-DUSE_DEC_OPENMPT=OFF"
+    "-DUSE_DEC_XMP=OFF"
+    "-DUSE_DEC_MODPLUG=OFF"
+    "-DUSE_DEC_MPG123=OFF"
+    "-DUSE_DEC_SNDFILE=OFF"
+    "-DUSE_DEC_LIBVORBIS=OFF"
+    "-DUSE_DEC_LIBOPUSFILE=OFF"
+    "-DUSE_DEC_MUSEPACK=OFF"
+    "-DUSE_DEC_FLUIDSYNTH=OFF"
+    "-DUSE_DEC_BASSMIDI=OFF"
+    "-DUSE_DEC_WILDMIDI=OFF"
+    "-DUSE_DEC_ADLMIDI=OFF"
+  ];
+
+  meta = with lib; {
+    description = "Audio decoding, resampling and mixing library for SDL";
+    homepage = "https://github.com/realnc/SDL_audiolib";
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}

pkgs/development/ocaml-modules/toml/default.nix

@@ -4,15 +4,13 @@
 
 buildDunePackage rec {
   pname = "toml";
-  version = "6.0.0";
-
-  useDune2 = true;
+  version = "7.0.0";
 
   src = fetchFromGitHub {
     owner = "ocaml-toml";
     repo = "to.ml";
     rev = version;
-    sha256 = "08ywzqckllvwawl1wpgg7qzvx6jhq7d6vysa0d5hj7qdwq213ggm";
+    sha256 = "sha256-VEZQTFPwAGShCBGbKUiNOIY1zA/JdTpXU0ZIGNWopnQ=";
   };
 
   nativeBuildInputs = [ menhir ];

pkgs/development/python-modules/httpx-ntlm/default.nix

@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "httpx_ntlm";
     inherit version;
-    sha256 = "sha256-pv/OxgcO0JWk2nCZp+bKlOdX7NqV6V5xZRDy5dd13qQ=";
+    hash = "sha256-pv/OxgcO0JWk2nCZp+bKlOdX7NqV6V5xZRDy5dd13qQ=";
   };
 
   propagatedBuildInputs = [
@@ -26,6 +26,12 @@ buildPythonPackage rec {
     pyspnego
   ];
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "pyspnego==0.3.*" "pyspnego>=0.3.*" \
+      --replace "cryptography==36.0.*" "cryptography>=36.0.*"
+  '';
+
   # https://github.com/ulodciv/httpx-ntlm/issues/5
   doCheck = false;
 

pkgs/games/devilutionx/default.nix

@@ -3,11 +3,13 @@
 , fetchFromGitHub
 , fetchpatch
 , fetchurl
-, fetchzip
+, bzip2
 , cmake
 , pkg-config
 , gettext
+, libsodium
 , SDL2
+, SDL_audiolib
 , SDL2_image
 , fmt
 , libpng
@@ -16,40 +18,56 @@
 
 let
   # TODO: submit a PR upstream to allow system copies of these libraries where possible
+
+  # fork with patches, far behind upstream
   asio = fetchurl {
     url = "https://github.com/diasurgical/asio/archive/ebeff99f539da23d27c2e8d4bdbc1ee011968644.tar.gz";
     sha256 = "0vhb4cig40mm0a98i74grpmfkcmby8zxg6vqa38dpryxpgvp5fw8";
   };
 
-  SDL_audiolib = fetchurl {
-    url = "https://github.com/realnc/SDL_audiolib/archive/aa79660eba4467a44f9dcaecf26b0f0a000abfd7.tar.gz";
-    sha256 = "0z4rizncp6gqsy72b3709zc9fr915wgcwnlx1fhhy7mrczsly630";
+  # fork with patches, upstream seems to be dead
+  libmpq = fetchurl {
+    url = "https://github.com/diasurgical/libmpq/archive/0f10bd1600f406b13932bf5351ba713361262184.tar.gz";
+    sha256 = "sha256-7hc/Xtsg8WJIJljLydS7hLZA9lEEHWhsCteyrxK68qE=";
   };
 
-  simpleini = fetchzip {
-    url = "https://github.com/brofield/simpleini/archive/7bca74f6535a37846162383e52071f380c99a43a.zip";
-    sha256 = "07kf1jjbc9v04hsysa6v2wh1m9csf5qz0b1wmlkf9sj00kf47zj7";
+  # not "real" package with pkg-config or cmake file, just collection of source files
+  libsmackerdec = fetchurl {
+    url = "https://github.com/diasurgical/libsmackerdec/archive/2997ee0e41e91bb723003bc09234be553b190e38.tar.gz";
+    sha256 = "sha256-QMDcIZQ94i4VPVanmSxiGkKgxWx82DP4uE+Q5I2nU+o=";
+  };
+
+  # fork with patches, far behind upstream
+  libzt = fetchFromGitHub {
+    owner = "diasurgical";
+    repo = "libzt";
+    fetchSubmodules = true;
+    rev = "a34ba7f1cc2e41b05badd25d1b01fdc5fd2f4e02";
+    sha256 = "sha256-tyIPt+7OTi5W+5X/ixQP1puOKdhrqRZtpwXlWFBFpc8=";
+  };
+
+  # missing pkg-config and/or cmake file
+  simpleini = fetchurl {
+    url = "https://github.com/brofield/simpleini/archive/9b3ed7ec815997bc8c5b9edf140d6bde653e1458.tar.gz";
+    sha256 = "sha256-93kuyp8/ew7okW/6ThJMtLMZsR1YSeFcXu9Y65ELBFE==";
   };
 in
 
 stdenv.mkDerivation rec {
   pname = "devilutionx";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "diasurgical";
     repo = "devilutionX";
     rev = version;
-    sha256 = "0acrkqi0pr3cbr5i1a1vfrnxv1n3xmql5d86bm2gywvpdb94xads";
+    sha256 = "sha256-uuIPTdgGpHA8j1M8b+kfnBuiJ5mdS9rckvEfn2h7lmo=";
   };
 
   patches = [
-    # allow building with system SDL2_image instead of vendored version
-    # this patch can be removed on the next release of devilutionx
-    # see https://github.com/diasurgical/devilutionX/pull/3386
     (fetchpatch {
-      url = "https://github.com/diasurgical/devilutionX/commit/41ff03e94c02477bffb2d62764e8624c0e06854d.patch";
-      sha256 = "1lrnb9d0dcdyd78rix5rl4p8kkwbnl91llr9fgb86ysm3q58qkvj";
+      url = "https://github.com/diasurgical/devilutionX/commit/03b22352fc9e1ecb88b20a053c90c04a50717267.patch";
+      sha256 = "sha256-5aAwi1NV8P+nLLbEEnlwLGNQCQBb0nQkIVe5tR5Shsw=";
     })
   ];
 
@@ -57,16 +75,18 @@ stdenv.mkDerivation rec {
     substituteInPlace Source/init.cpp --replace "/usr/share/diasurgical/devilutionx/" "${placeholder "out"}/share/diasurgical/devilutionx/"
 
     # download dependencies ahead of time
-    substituteInPlace 3rdParty/asio/CMakeLists.txt --replace "https://github.com/diasurgical/asio/archive/ebeff99f539da23d27c2e8d4bdbc1ee011968644.tar.gz" "${asio}"
-    substituteInPlace 3rdParty/SDL_audiolib/CMakeLists.txt --replace "https://github.com/realnc/SDL_audiolib/archive/aa79660eba4467a44f9dcaecf26b0f0a000abfd7.tar.gz" "${SDL_audiolib}"
-    substituteInPlace 3rdParty/simpleini/CMakeLists.txt --replace "https://github.com/brofield/simpleini/archive/7bca74f6535a37846162383e52071f380c99a43a.zip" "${simpleini}"
+    substituteInPlace 3rdParty/asio/CMakeLists.txt --replace "${asio.url}" "${asio}"
+    substituteInPlace 3rdParty/libmpq/CMakeLists.txt --replace "${libmpq.url}" "${libmpq}"
+    substituteInPlace 3rdParty/libsmackerdec/CMakeLists.txt --replace "${libsmackerdec.url}" "${libsmackerdec}"
+    substituteInPlace 3rdParty/libzt/CMakeLists.txt \
+      --replace "GIT_REPOSITORY https://github.com/diasurgical/libzt.git" "" \
+      --replace "GIT_TAG ${libzt.rev}" "SOURCE_DIR ${libzt}"
+    substituteInPlace 3rdParty/simpleini/CMakeLists.txt --replace "${simpleini.url}" "${simpleini}"
   '';
 
   cmakeFlags = [
     "-DBINARY_RELEASE=ON"
     "-DVERSION_NUM=${version}"
-    "-DPACKET_ENCRYPTION=OFF" # FIXME: build with libsodium
-    "-DDISABLE_ZERO_TIER=ON" # FIXME: build with libzt
   ];
 
   nativeBuildInputs = [
@@ -77,9 +97,12 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    bzip2
     fmt
     libpng
+    libsodium
     SDL2
+    SDL_audiolib
     SDL2_image
   ];
 

pkgs/os-specific/darwin/mas/default.nix

@@ -1,38 +1,41 @@
 { lib
-, stdenv
+, stdenvNoCC
 , fetchurl
-, libarchive
-, p7zip
+, installShellFiles
+, testVersion
+, mas
 }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "mas";
-  version = "1.8.2";
+  version = "1.8.6";
 
   src = fetchurl {
-    url = "https://github.com/mas-cli/mas/releases/download/v${version}/mas.pkg";
-    sha256 = "HlLQKBVIYKanS6kjkbYdabBi1T0irxE6fNd2H6mDKe4=";
+    # Use the tarball until https://github.com/mas-cli/mas/issues/452 is fixed.
+    # Even though it looks like an OS/arch specific build it is actually a universal binary.
+    url = "https://github.com/mas-cli/mas/releases/download/v${version}/mas-${version}.monterey.bottle.tar.gz";
+    sha256 = "0q4skdhymgn5xrwafyisfshx327faia682yv83mf68r61m2jl10d";
   };
 
-  nativeBuildInputs = [ libarchive p7zip ];
-
-  unpackPhase = ''
-    7z x $src
-    bsdtar -xf Payload~
-  '';
-
-  dontBuild = true;
+  nativeBuildInputs = [ installShellFiles ];
 
   installPhase = ''
-    mkdir -p $out
-    cp -r ./usr/local/bin $out
+    install -D './${version}/bin/mas' "$out/bin/mas"
+    installShellCompletion --cmd mas --bash './${version}/etc/bash_completion.d/mas'
   '';
 
+  passthru.tests = {
+    version = testVersion {
+      package = mas;
+      command = "mas version";
+    };
+  };
+
   meta = with lib; {
     description = "Mac App Store command line interface";
     homepage = "https://github.com/mas-cli/mas";
     license = licenses.mit;
-    maintainers = with maintainers; [ zachcoyle ];
-    platforms = platforms.darwin;
+    maintainers = with maintainers; [ steinybot zachcoyle ];
+    platforms = [ "x86_64-darwin" "aarch64-darwin" ];
   };
 }

pkgs/os-specific/darwin/moltenvk/default.nix

@@ -29,7 +29,7 @@ let
 in
 stdenvNoCC.mkDerivation rec {
   pname = "MoltenVK";
-  version = "1.1.8";
+  version = "1.1.9";
 
   buildInputs = [
     AppKit
@@ -51,8 +51,8 @@ stdenvNoCC.mkDerivation rec {
       src = fetchFromGitHub {
         owner = "KhronosGroup";
         repo = "glslang";
-        rev = "90d4bd05cd77ef5782a6779a0fe3d084440dc80d";
-        hash = "sha256-Q0sk4bPj/skPat1n4GJyuXAlZqpfEn4Td8Bm2IBNUqE=";
+        rev = "9bb8cfffb0eed010e07132282c41d73064a7a609";
+        hash = "sha256-YLn/Mxuk6mXPGtBBgfwky5Nl1TCAW6i2g+AZLzqVz+A=";
       };
     })).override {
       inherit (passthru) spirv-headers spirv-tools;
@@ -64,27 +64,24 @@ stdenvNoCC.mkDerivation rec {
       src = fetchFromGitHub {
         owner = "KhronosGroup";
         repo = "SPIRV-Cross";
-        rev = "131278458ea8eebe6a6e9c476fbcf71278726e1a";
-        hash = "sha256-LrRYDFGv3Zxfy4qRNLwM2OOa8jbcq0ttPxDamCH21xU=";
+        rev = "0d4ce028bf8b8a94d325dc1e1c20446153ba19c4";
+        hash = "sha256-OluTxOEfDIGMdrXhvIifjpMgZBvyh9ofLKxKt0dX5ZU=";
       };
     });
     spirv-headers = spirv-headers.overrideAttrs (_: {
       src = fetchFromGitHub {
         owner = "KhronosGroup";
         repo = "spirv-headers";
-        rev = "b42ba6d92faf6b4938e6f22ddd186dbdacc98d78";
-        hash = "sha256-ks9JCj5rj+Xu++7z5RiHDkU3/sFXhcScw8dATfB/ot0";
+        rev = "4995a2f2723c401eb0ea3e10c81298906bf1422b";
+        hash = "sha256-LkIrTFWYvZffLVJJW3152um5LTEsMJEDEsIhBAdhBlk=";
       };
     });
     spirv-tools = (spirv-tools.overrideAttrs (old: {
       src = fetchFromGitHub {
         owner = "KhronosGroup";
         repo = "spirv-tools";
-        rev = "45dd184c790d6bfc78a5a74a10c37e888b1823fa";
-        hash = "sha256-DSqZlwfNTbN4fyIrVBKltm5U2U4GthW3L+Ksw4lSVG8=";
-      };
-      meta = old.meta // {
-        platforms = old.meta.platforms ++ lib.platforms.darwin;
+        rev = "eed5c76a57bb965f2e1b56d1dc40b50910b5ec1d";
+        hash = "sha256-2Mr3HbhRslLpRfwHascl7e/UoPijhrij9Bjg3aCiqBM=";
       };
     })).override {
       inherit (passthru) spirv-headers;
@@ -93,11 +90,8 @@ stdenvNoCC.mkDerivation rec {
       src = fetchFromGitHub {
         owner = "KhronosGroup";
         repo = "Vulkan-Headers";
-        rev = "1dace16d8044758d32736eb59802d171970e9448";
-        hash = "sha256-C6YgxWcinI3QumcWmoJaiTAf0u6jSDc8sCIarn2t04k";
-      };
-      meta = old.meta // {
-        platforms = old.meta.platforms ++ lib.platforms.darwin;
+        rev = "76f00ef6cbb1886eb1162d1fa39bee8b51e22ee8";
+        hash = "sha256-FqrcFHsUS8e4ZgZpxVc8nNZWdNltniFmMjyyWVoNc7w=";
       };
     });
   };
@@ -106,7 +100,7 @@ stdenvNoCC.mkDerivation rec {
     owner = "KhronosGroup";
     repo = "MoltenVK";
     rev = "v${version}";
-    hash = "sha256-IfTBtA2fM7YN4qaSDUTfsiCXzn+omSV6oroL1ivKiVA=";
+    hash = "sha256-5ie1IGzZqaYbciFnrBJ1/9V0LEuz7JsEOFXXkG3hJzg=";
   };
 
   patches = [

pkgs/os-specific/linux/nvidia-x11/default.nix

@@ -39,12 +39,12 @@ rec {
   # Vulkan developer beta driver
   # See here for more information: https://developer.nvidia.com/vulkan-driver
   vulkan_beta = generic rec {
-    version = "455.46.04";
-    persistencedVersion = "455.45.01";
-    settingsVersion = "455.45.01";
-    sha256_64bit = "1iv42w3x1vc00bgn6y4w1hnfsvnh6bvj3vcrq8hw47760sqwa4xa";
-    settingsSha256 = "09v86y2c8xas9ql0bqr7vrjxx3if6javccwjzyly11dzffm02h7g";
-    persistencedSha256 = "13s4b73il0lq2hs81q03176n16mng737bfsp3bxnxgnrv3whrayz";
+    version = "470.62.13";
+    persistencedVersion = "470.86";
+    settingsVersion = "470.86";
+    sha256_64bit = "sha256-itBFNPMy+Nn0g8V8qdkRb+ELHj57GRso1lXhPHUxKVI=";
+    settingsSha256 = "sha256-fq6RlD6g3uylvvTjE4MmaQwxPJYU0u6IMfpPVzks0tI=";
+    persistencedSha256 = "sha256-eHvauvh8Wd+b8DK6B3ZWNjoWGztupWrR8iog9ok58io=";
     url = "https://developer.nvidia.com/vulkan-beta-${lib.concatStrings (lib.splitString "." version)}-linux";
   };
 

pkgs/servers/consul/default.nix

@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "consul";
-  version = "1.11.5";
+  version = "1.12.0";
   rev = "v${version}";
 
   # Note: Currently only release tags are supported, because they have the Consul UI
@@ -17,7 +17,7 @@ buildGoModule rec {
     owner = "hashicorp";
     repo = pname;
     inherit rev;
-    sha256 = "sha256-3eZoRhPxPp2Yu7jR72j1nHRJ0k/oEtYbMDCR5pB9r54=";
+    sha256 = "sha256-O47s9eNZsqg0zpgoK2S4JvuOEqqVWvx8YmbQTvCw0Co=";
   };
 
   passthru.tests.consul = nixosTests.consul;
@@ -26,7 +26,7 @@ buildGoModule rec {
   # has a split module structure in one repo
   subPackages = ["." "connect/certgen"];
 
-  vendorSha256 = "sha256-fgqIINd0kfzzVu4EhTuLoQN64WJyjvVWxryp93yUIac=";
+  vendorSha256 = "sha256-NRFGt8YA179C/OvyMGXYaZMUH685pJfdGB0AhMrCixs=";
 
   doCheck = false;
 

pkgs/servers/home-assistant/component-packages.nix

@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2022.4.5";
+  version = "2022.4.6";
   components = {
     "abode" = ps: with ps; [
       abodepy
@@ -1244,7 +1244,10 @@
     "input_text" = ps: with ps; [
     ];
     "insteon" = ps: with ps; [
+      aiohttp-cors
       pyinsteon
+      pyserial
+      pyudev
     ];
     "integration" = ps: with ps; [
     ];

pkgs/servers/home-assistant/default.nix

@@ -168,7 +168,7 @@ let
   extraPackagesFile = writeText "home-assistant-packages" (lib.concatMapStringsSep "\n" (pkg: pkg.pname) extraBuildInputs);
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2022.4.5";
+  hassVersion = "2022.4.6";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -186,7 +186,7 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = version;
-    hash = "sha256-rt1hNkjt000Wd/Wg4ThK/GJxQ/q7wysmSlzrvc4joCE=";
+    hash = "sha256-f2cPkORh6DoNjqZFz7XjxQdZwej3k+8NtZTstYIbrc4=";
   };
 
   # leave this in, so users don't have to constantly update their downstream patch handling

pkgs/servers/mautrix-signal/default.nix

@@ -2,13 +2,13 @@
 
 python3.pkgs.buildPythonPackage rec {
   pname = "mautrix-signal";
-  version = "0.2.2";
+  version = "0.2.3";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "signal";
     rev = "v${version}";
-    sha256 = "sha256-gJngGgShW63g5zSyZraod0YTt/pFtVLySDXNXXC5Xxs=";
+    sha256 = "sha256-P5a/JoL6PBkYDDitlkMj2QClvcXMgXcnup5EAatGcSs=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [

pkgs/tools/admin/awscli2/default.nix

@@ -52,7 +52,7 @@ with py.pkgs; buildPythonApplication rec {
     rsa
     ruamel-yaml
     wcwidth
-    dateutil
+    python-dateutil
     jmespath
     urllib3
   ];

pkgs/tools/backup/bakelite/default.nix

@@ -2,17 +2,21 @@
 
 stdenv.mkDerivation rec {
   pname = "bakelite";
-  version = "unstable-2021-10-19";
+  version = "unstable-2022-02-12";
 
   src = fetchFromGitHub {
     owner = "richfelker";
     repo = pname;
-    rev = "5fc3cf9704dbaa191b95f97d2a700588ea878a36";
-    sha256 = "xoGor8KMG1vU6hP6v6gHcADKjVpaClvkivxkcPUJtss=";
+    rev = "373901734d114e42aa385e6a7843745674e4ca08";
+    hash = "sha256-HBnYlUyTkvPTbdsZD02yCq5C7yXOHYK4l4mDRUkcN5I=";
   };
 
   hardeningEnable = [ "pie" ];
-  buildFlags = [ "CFLAGS=-D_GNU_SOURCE" ];
+  preBuild = ''
+    # pipe2() is only exposed with _GNU_SOURCE
+    # Upstream makefile explicitly uses -O3 to improve SHA-3 performance
+    makeFlagsArray+=( CFLAGS="-D_GNU_SOURCE -g -O3" )
+  '';
 
   installPhase = ''
     mkdir -p $out/bin
@@ -23,7 +27,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/richfelker/bakelite";
     description = "Incremental backup with strong cryptographic confidentality";
     license = licenses.gpl2;
-    platforms = platforms.linux;
     maintainers = with maintainers; [ mvs ];
+    platforms = platforms.unix;
   };
 }

pkgs/tools/compression/pigz/default.nix

@@ -1,12 +1,14 @@
-{ lib, stdenv, fetchurl, zlib, util-linux }:
+{ lib, stdenv, fetchFromGitHub, zlib, util-linux }:
 
 stdenv.mkDerivation rec {
   pname = "pigz";
   version = "2.6";
 
-  src = fetchurl {
-    url = "https://www.zlib.net/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Lu17DXRJ0dcJA/KmLNYAXSYus6jJ6YaHvIy7WAnbKn0=";
+  src = fetchFromGitHub {
+      owner = "madler";
+      repo = "${pname}";
+      rev = "refs/tags/v${version}";
+      sha256 = "146qkmzi199xwmmf6bllanqfyl702fm1rnad8cd5r5yyrp5ks115";
   };
 
   enableParallelBuilding = true;

pkgs/tools/misc/addlicense/default.nix

@@ -0,0 +1,27 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "addlicense";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "addlicense";
+    rev = "v${version}";
+    sha256 = "sha256-Nv7Az3TDtd1P/QWjH92otSV9rIrc2l/mTbGUXhODi7Q=";
+  };
+
+  vendorSha256 = "sha256-2mncc21ecpv17Xp8PA9GIodoaCxNBacbbya/shU8T9Y=";
+
+  subPackages = [ "." ];
+
+  meta = with lib; {
+    description = "Ensures source code files have copyright license headers by scanning directory patterns recursively";
+    homepage = "https://github.com/google/addlicense";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}

pkgs/tools/misc/synth/default.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "synth";
-  version = "0.6.4";
+  version = "0.6.5-r1";
 
   src = fetchFromGitHub {
     owner = "getsynth";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-TtIZwGHSfY7Xz6hmrsmaB7dXfjSPcBD4yDyC27TJ4B4=";
+    sha256 = "sha256-AcAZjS2Wo0PRngf0eYrduEd6rZX5YpYxsWEp0wf9jvg=";
   };
 
-  cargoSha256 = "sha256-V5GA5XR3wkcBdbxRjO8PkF7Q3yg1NVUjXsdAHVip4Bc=";
+  cargoSha256 = "sha256-mMGlUCvbXaO0XfMwVtpq7HENoSaXrQU7GSh7/OhYdus=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/tools/networking/bitmask-vpn/default.nix

@@ -78,6 +78,9 @@ buildGoModule rec {
     substituteInPlace providers/vendor.conf \
       --replace "provider = riseup" "provider = ${provider}"
 
+    substituteInPlace branding/templates/debian/app.desktop-template \
+      --replace "Icon=icon" "Icon=${pname}"
+
     patchShebangs gui/build.sh
     wrapPythonProgramsIn branding/scripts
   '' + lib.optionalString stdenv.isLinux ''
@@ -130,11 +133,12 @@ buildGoModule rec {
   '';
 
   postInstall = ''
-    install -m 755 -D -t $out/bin build/qt/release/${provider}-vpn
+    install -m 755 -D -t $out/bin build/qt/release/${pname}
 
     VERSION=${version} VENDOR_PATH=providers branding/scripts/generate-debian branding/templates/debian/data.json
     (cd branding/templates/debian && ${python3Packages.python}/bin/python3 generate.py)
-    install -m 444 -D branding/templates/debian/app.desktop $out/share/applications/${provider}-vpn.desktop
+    install -m 444 -D branding/templates/debian/app.desktop $out/share/applications/${pname}.desktop
+    install -m 444 -D providers/${provider}/assets/icon.svg $out/share/icons/hicolor/scalable/apps/${pname}.svg
   '' + lib.optionalString stdenv.isLinux ''
     install -m 444 -D -t $out/share/polkit-1/actions ${bitmask-root}/share/polkit-1/actions/se.leap.bitmask.policy
   '';
@@ -154,7 +158,7 @@ buildGoModule rec {
       a variety of trusted service provider all from one app.
       Current providers include Riseup Networks
       and The Calyx Institute, where the former is default.
-      The <literal>${provider}-vpn</literal> executable should appear
+      The <literal>${pname}</literal> executable should appear
       in your desktop manager's XDG menu or could be launch in a terminal
       to get an execution log. A new icon should then appear in your systray
       to control the VPN and configure some options.

pkgs/tools/package-management/comma/default.nix

@@ -1,55 +1,43 @@
 { lib
-, stdenv
-, fetchurl
+, rustPlatform
 , fetchFromGitHub
-, linkFarm
-, nix-index
+, nix
 , fzy
+, makeWrapper
+, testVersion
+, comma
 }:
 
-let
-
-  # nix-index takes a little while to run and the contents don't change
-  # meaningfully very often.
-  indexCache = fetchurl {
-    url = "https://github.com/Mic92/nix-index-database/releases/download/2021-12-12/index-x86_64-linux";
-    sha256 = "sha256-+SoG5Qz2KWA/nIWXE6SLpdi8MDqTs8LY90fGZxGKOiA=";
-  };
-
-  # nix-locate needs the --db argument to be a directory containing a file
-  # named "files".
-  nixIndexDB = linkFarm "nix-index-cache" [
-    { name = "files"; path = indexCache; }
-  ];
-
-in stdenv.mkDerivation rec {
+rustPlatform.buildRustPackage rec {
   pname = "comma";
-  version = "1.1.0";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "nix-community";
-    repo = pname;
-    rev = version;
-    sha256 = "sha256-WBIQmwlkb/GMoOq+Dnyrk8YmgiM/wJnc5HYZP8Uw72E=";
+    repo = "comma";
+    rev = "v${version}";
+    sha256 = "sha256-emhvBaicLAnu/Kn4oxHngGa5BSxOEwbkhTLO5XvauMw=";
   };
 
-  postPatch = ''
-    substituteInPlace , \
-      --replace '$PREBUILT_NIX_INDEX_DB' "${nixIndexDB}" \
-      --replace nix-locate "${nix-index}/bin/nix-locate" \
-      --replace fzy "${fzy}/bin/fzy"
+  cargoSha256 = "sha256-mQxNo4VjW2Q0MYfU+RCb4Ayl9ClpxrSV8X4EKZ7PewA=";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postInstall = ''
+    wrapProgram $out/bin/comma \
+      --prefix PATH : ${lib.makeBinPath [ nix fzy ]}
+    ln -s $out/bin/comma $out/bin/,
   '';
 
-  installPhase = ''
-    install -Dm755 , -t $out/bin
-    ln -s $out/bin/, $out/bin/comma
-  '';
+  passthru.tests = {
+    version = testVersion { package = comma; };
+  };
 
   meta = with lib; {
     homepage = "https://github.com/nix-community/comma";
-    description = "Run software without installing it";
+    description = "Runs programs without installing them";
     license = licenses.mit;
-    maintainers = with maintainers; [ Enzime ];
+    maintainers = with maintainers; [ Enzime artturin ];
     platforms = platforms.all;
   };
 }

pkgs/top-level/all-packages.nix

@@ -958,6 +958,8 @@ with pkgs;
 
   adafruit-ampy = callPackage ../tools/misc/adafruit-ampy { };
 
+  addlicense = callPackage ../tools/misc/addlicense { };
+
   adlplug = callPackage ../applications/audio/adlplug {
     inherit (darwin) libobjc;
     inherit (darwin.apple_sdk.frameworks) Cocoa CoreServices WebKit DiscRecording;
@@ -3964,6 +3966,8 @@ with pkgs;
 
   oil-buku = callPackage ../applications/misc/oil-buku { };
 
+  osdlyrics = callPackage ../applications/audio/osdlyrics { };
+
   ossutil = callPackage ../tools/admin/ossutil {};
 
   pastel = callPackage ../applications/misc/pastel {
@@ -4974,6 +4978,8 @@ with pkgs;
 
   debian-devscripts = callPackage ../tools/misc/debian-devscripts { };
 
+  debian-goodies = callPackage ../applications/misc/debian-goodies { };
+
   debootstrap = callPackage ../tools/misc/debootstrap { };
 
   debugedit = callPackage ../development/tools/misc/debugedit { };
@@ -20270,6 +20276,8 @@ with pkgs;
     libGLU = null;
   });
 
+  SDL_audiolib = callPackage ../development/libraries/SDL_audiolib { };
+
   SDL_sixel = callPackage ../development/libraries/SDL_sixel { };
 
   SDL_gfx = callPackage ../development/libraries/SDL_gfx { };

pkgs/top-level/python-packages.nix

@@ -2410,7 +2410,11 @@ in {
 
   dm-sonnet = callPackage ../development/python-modules/dm-sonnet { };
 
-  dm-tree = callPackage ../development/python-modules/dm-tree { };
+  dm-tree = callPackage ../development/python-modules/dm-tree {
+    abseil-cpp = pkgs.abseil-cpp.override {
+      cxxStandard = "14";
+    };
+  };
 
   dnachisel = callPackage ../development/python-modules/dnachisel { };